| Package | Affected versions | Patched versions |
|---|---|---|
| manageengine access manager plus | = 4.0= 4.1= 4.2= 4.3 | |
| manageengine pam360 | = 4.0= 4.1= 4.5= 5.0= 5.1= 5.2= 5.3= 5.4 | |
| manageengine password manager pro | = 10.1= 10.2= 10.3= 10.4= 11.1= 11.2= 11.3= 12.0 |
Zoho ManageEngine Access Manager Plus before 4302, Password Manager Pro before 12007, and PAM360 before 5401 are vulnerable to access-control bypass on a few Rest API URLs (for SSOutAction. SSLAction. LicenseMgr. GetProductDetails. GetDashboard. FetchEvents. and Synchronize) via the ../RestAPI substring.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free